1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
export function middleware(request: NextRequest) {
const response = NextResponse.next();
const { pathname } = request.nextUrl;
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
const cspDirectives = [
"default-src 'self'",
`script-src 'self' 'nonce-${nonce}' 'strict-dynamic'`,
`style-src 'self' 'unsafe-inline'`,
"img-src 'self' data: blob:",
"font-src 'self'",
`connect-src 'self' ${process.env.KEYCLOAK_ISSUER || ""}`,
"frame-ancestors 'none'",
"base-uri 'self'",
"form-action 'self'",
"upgrade-insecure-requests",
];
if (pathname.startsWith("/admin")) {
return response;
}
response.headers.set(
"Content-Security-Policy",
cspDirectives.join("; ")
);
response.headers.set("X-Nonce", nonce);
return response;
}
export const config = {
matcher: [
"/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
],
};
|
